[PATCH] RDMA/rtrs: Register client event handler after capability check

[PATCH] RDMA/rtrs: Register client event handler after capability check

[Jaeyeong Lee]

rtrs_clt_ib_dev_init() registers dev->event_handler before checking
IB_DEVICE_MEM_MGT_EXTENSIONS. If the device does not provide that
capability, init returns -ENOTSUPP and rtrs_ib_dev_find_or_add() frees
dev through out_free_pd without calling the deinit callback. The embedded
event handler therefore remains on the IB device's list after its storage
has been freed.

A later IB event walks the dangling list entry and accesses freed memory.
The issue was found by static analysis. A focused out-of-tree test module
on an x86_64 QEMU/KASAN kernel temporarily cleared only
IB_DEVICE_MEM_MGT_EXTENSIONS on a SIW device, exercised the real
rtrs_clt_ib_dev_init() callback through rtrs_ib_dev_find_or_add(), restored
the capabilities, and dispatched IB_EVENT_DEVICE_FATAL. KASAN reported
an 8-byte slab-use-after-free read in ib_dispatch_event_clients(), with
both the allocation and free originating in rtrs_ib_dev_find_or_add().

Move the capability check before event handler registration. The check is
a prerequisite for successful client initialization. Registration cannot
fail and init returns success immediately afterwards, so every installed
handler is now owned by a successfully initialized device and is removed
by the existing deinit callback.

Fixes: 667db86bcbe8 ("RDMA/rtrs: Register ib event handler")
Cc: stable@vger.kernel.org
Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
---
 drivers/infiniband/ulp/rtrs/rtrs-clt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index bf3a0377da3ff..85eaa2bdb4704 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -3191,16 +3191,16 @@ void rtrs_clt_ib_event_handler(struct ib_event_handler *handler,
 
 static int rtrs_clt_ib_dev_init(struct rtrs_ib_dev *dev)
 {
-	INIT_IB_EVENT_HANDLER(&dev->event_handler, dev->ib_dev,
-			      rtrs_clt_ib_event_handler);
-	ib_register_event_handler(&dev->event_handler);
-
 	if (!(dev->ib_dev->attrs.device_cap_flags &
 	      IB_DEVICE_MEM_MGT_EXTENSIONS)) {
 		pr_err("Memory registrations not supported.\n");
 		return -ENOTSUPP;
 	}
 
+	INIT_IB_EVENT_HANDLER(&dev->event_handler, dev->ib_dev,
+			      rtrs_clt_ib_event_handler);
+	ib_register_event_handler(&dev->event_handler);
+
 	return 0;
 }
 
-- 
2.43.0

Re: [PATCH] RDMA/rtrs: Register client event handler after capability check

[sashiko-bot]

> rtrs_clt_ib_dev_init() registers dev->event_handler before checking
> IB_DEVICE_MEM_MGT_EXTENSIONS. If the device does not provide that
> capability, init returns -ENOTSUPP and rtrs_ib_dev_find_or_add() frees
> dev through out_free_pd without calling the deinit callback. The embedded
> event handler therefore remains on the IB device's list after its storage
> has been freed.
> 
> A later IB event walks the dangling list entry and accesses freed memory.
> The issue was found by static analysis. A focused out-of-tree test module
> on an x86_64 QEMU/KASAN kernel temporarily cleared only
> IB_DEVICE_MEM_MGT_EXTENSIONS on a SIW device, exercised the real
> rtrs_clt_ib_dev_init() callback through rtrs_ib_dev_find_or_add(), restored
> the capabilities, and dispatched IB_EVENT_DEVICE_FATAL. KASAN reported
> an 8-byte slab-use-after-free read in ib_dispatch_event_clients(), with
> both the allocation and free originating in rtrs_ib_dev_find_or_add().
> 
> Move the capability check before event handler registration. The check is
> a prerequisite for successful client initialization. Registration cannot
> fail and init returns success immediately afterwards, so every installed
> handler is now owned by a successfully initialized device and is removed
> by the existing deinit callback.
> 
> Fixes: 667db86bcbe8 ("RDMA/rtrs: Register ib event handler")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179378222423.73361.3247716499619173751@jaeyeong.cc?part=1

Re: [PATCH] RDMA/rtrs: Register client event handler after capability check

[Leon Romanovsky]

On Wed, 04 Nov 2026 08:50:33 +0000, Jaeyeong Lee wrote:
> rtrs_clt_ib_dev_init() registers dev->event_handler before checking
> IB_DEVICE_MEM_MGT_EXTENSIONS. If the device does not provide that
> capability, init returns -ENOTSUPP and rtrs_ib_dev_find_or_add() frees
> dev through out_free_pd without calling the deinit callback. The embedded
> event handler therefore remains on the IB device's list after its storage
> has been freed.
> 
> [...]

Applied, thanks!

[1/1] RDMA/rtrs: Register client event handler after capability check
      https://git.kernel.org/rdma/rdma/c/90d95fbc1bcc84

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>